# Invite and approve people > Invite people to a Team Cloud team from the console or the app, approve each new Mac by comparing a 6-digit code, promote admins, and the optional automatic approval after SSO. Source: https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/ Added in Cloak Proxy 0.7.0. {/* L9 draft. Sources: PLAN 6.3, 6.4, 6.5 step 4, 8.3, 9.5 page 4; T5.1–T5.4. Re-check labels against L6/L8. */} Joining a team takes two things: an **invitation**, which reserves a seat for an email address, and an **approval**, in which an admin and the new person compare a 6-digit code before the new Mac gets the team's keys. Signing in alone, by email or SSO, never gives a Mac the keys. ## Invite people {/* PLAN 6.3 step 1, 8.3; T5.1 */} Owners and admins invite from the console's **Members** page (**Invite people**) or from **Settings › Team › Members › Invite…** on an admin's Mac. Enter one or more email addresses and a role: **Member** or **Admin**. - Each invitation reserves a seat. With no free seat, the console says so ("Add seats in Billing first"); the owner or a billing manager adds seats in **Billing**. See [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/). - The person gets an email with a **Join** link and a download link. The email holds no secret: it only lets that address ask to join. - Before the team's keys are set up, you can invite only admins: the first of them sets up the keys on their Mac. Everyone else can be invited once the keys exist. - Invitations expire. The **Members** table shows each person's state, such as **Invited · not joined yet**, **Invited · can set up keys** or **Waiting for approval**, with **Resend invitation** (it sends the email again) and a way to cancel it. **Change role…** works on an invitation too, until that person has asked to join. - If the [policy](https://docs.subcloak.com/cloak-proxy/team/policies/) **Invitations only to verified domains** is on, only addresses in your [verified domains](https://docs.subcloak.com/cloak-proxy/team/sso/#verify-your-domains) can be invited. - With [SCIM](https://docs.subcloak.com/cloak-proxy/team/scim/), your identity provider can create invitations too. Inviting someone as **Admin** gives them admin rights once they join, the same as a promotion. ## Approve a new person's Mac {/* PLAN 6.3 steps 2–4; T5.3 */} When an invited person clicks **Join** in Cloak Proxy, every admin's Mac shows a request in **Settings › Team › Join requests**, for example: "Alex (alex@acme.com) wants to join Acme on 'Alex's MacBook Pro'. Signed in with SSO: yes." Admins also get a **device request** notification on their Mac, and the console's overview lists people waiting. A request lasts 10 minutes: if it lapses, the person clicks **Join** again. 1. Click **Compare Codes…**. Your Mac shows "Compare this code with Alex (alex@acme.com): 123 456. Read it to them on a call or in chat; don't approve if it differs." 2. Read the code to the person over a channel you trust, such as a video call or your team chat. Don't send it by email to an address you haven't checked. 3. When they confirm it matches, approve. On their Mac they click **Codes Match**. 4. Their Mac receives the team key and the keys of any restricted spaces they're listed in, and starts syncing. Click **Deny** for a request you don't recognize. The comparison is what stops a dishonest server, or someone who took over the person's email, from slipping in a Mac of their own: if anything in between changed the keys, the two codes differ. > **Approving widens access:** > An approved Mac can read every open space at once, and the restricted spaces its owner is listed in. Approve only Macs you've checked with the person. ## A member's further Macs {/* PLAN 6.3 step 5; T5.3 who may approve */} A member adds another Mac the same way, and approves it from one of their own Macs after comparing codes there. An admin's Mac approves only a person's first Mac; when [automatic approval after SSO](#approve-macs-automatically-after-sso) is on, an approver Mac can also admit a member's further Mac. Up to 5 Macs per person, or the number in the **Devices per member** policy. ## Promote, demote and change roles {/* PLAN 6.5 step 4, 9.4 */} Owners and admins change a person's role from the console (**Members › ⋯ › Change role…**) or from **Settings › Team › Members › Change Role…**. - **Making someone an admin** widens power, so the console can only ask for it. An admin's Mac shows "Owner asked to make Alex an admin. Approve?" and the change happens only when an admin clicks **Approve** in **Settings › Team**. Until then the console shows the person as **Active · admin role waiting for approval**. For someone who is only invited, the console changes the invitation's role at once. - **Demoting an admin** runs automatically the next time an admin's Mac is online, because it never widens access. - A team must keep at least one admin. The console refuses to remove or demote the last one. ## Approve Macs automatically after SSO {/* PLAN 6.4; T5.4 (normative where they differ) */} Teams that use [SSO](https://docs.subcloak.com/cloak-proxy/team/sso/) can let chosen admin Macs approve some Macs without a code comparison. It's **off by default**, and only an admin's Mac can turn it on, in **Settings › Team › Security › Approve Macs automatically after SSO**, where you also pick the **approver Macs** (admin Macs that are usually on). The setting is signed into the team's member list, so Subcloak's server can't turn it on. When it's on, an approver Mac that is running admits a new Mac without a code only if all of these hold: - the request is from someone who is **already a member** of the team (a brand-new person's first Mac still needs a code comparison); - our server reports that the person signed in through the team's SSO in the last 15 minutes; - the person is within the **Devices per member** limit. The person's other Macs show "Your new Mac … was approved automatically after SSO. Was this you?", with **Not My Mac** to remove it. Every Mac admitted this way shows **via SSO** in the device list, changes the [Team Security code](https://docs.subcloak.com/cloak-proxy/team/team-keys/#the-team-security-code), and appears in the audit log. > **The trade-off:** > When this is on, Subcloak's server and your identity provider decide which Macs join for members who aren't admins. If either were compromised, a Mac they control could be admitted as one of those members. Until someone removes it, it can read everything in the team's open spaces, including their history. It can't write anything that applies, change who's in the team, hand out keys or read restricted spaces until the member compares a code between their two Macs. Admins' Macs are never approved automatically. When this is off, a person compares a code for every new Mac, and neither can admit one. The console shows the setting read-only on **SSO & SCIM**: "New Macs: approved by a person comparing a code" or "approved automatically after SSO (set on an admin's Mac)". ## Related - [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/): What each role can do. - [Remove people and leave a team](https://docs.subcloak.com/cloak-proxy/team/leaving-and-removal/): What removal does and when keys change. - [Single sign-on](https://docs.subcloak.com/cloak-proxy/team/sso/): OIDC: Okta, Microsoft Entra ID, Google Workspace and other OIDC providers. SAML is coming later. - [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/): Who takes a seat, and adding seats.